CIA Warns of Russian Drone Threat to Southern Europe: How Shadow Fleet Cargo Ships Create a New NATO Vulnerability

Russia has already tested the maritime use of unmanned aircraft. ZALA, a Russian defence contractor, conducted vessel-launched UAV trials from 2020, progressing from launches involving moving boats to operations from stationary maritime platforms by late 2024. A later Baltic incident involving a drone launched from the Russian intelligence-gathering vessel Zhigulevsk provided another indication that maritime UAV operations were not merely theoretical.

The Mediterranean offers a different strategic environment.

The region contains dense commercial traffic, major ports and airports, energy infrastructure and critical maritime routes. It is also home to hundreds of vessels operating through opaque ownership and insurance arrangements associated with Russia's shadow fleet.

That creates an unusually large area in which a military capability can be hidden inside ordinary economic activity.

The reported plan centres on the Gerbera, a platform originally developed as a cheap counterpart to more expensive attack drones. Constructed largely from styrofoam and plywood, it can perform reconnaissance and decoy missions as well as carry an explosive payload. Its relatively modest capabilities become more consequential when the launch point moves offshore.

A Gerbera can travel as far as about 600km, with a payload typically described as 4–5kg. From a vessel positioned hundreds of kilometres from the coast, a drone could reach a coastal target without requiring a conventional aircraft, missile launcher or identifiable military ship to approach the area.

That is precisely where traditional assumptions about air defence begin to break down.

The weapon is cheap. The response is not.

European air-defence architecture has been built around a mixture of conventional military threats, including aircraft, cruise missiles and ballistic missiles. A maritime container concealing a small drone introduces another problem: the target is not necessarily identifiable until the weapon is already in flight.

The distinction between a cargo vessel and a launch platform becomes particularly important. NATO and European maritime authorities can monitor shipping, but the Mediterranean contains vast numbers of commercial vessels moving through international waters. Existing mechanisms cannot physically inspect every container or treat every merchant ship as a potential missile platform.

The EU's EUNAVFOR MED IRINI operation and NATO's Shipping Centre already provide mechanisms for maritime monitoring and reporting. Their existence, however, does not eliminate the underlying surveillance problem.

A container is one of the basic units of global commerce precisely because it makes cargo difficult to distinguish by appearance alone.

That creates an asymmetric equation. Russia can potentially impose a relatively inexpensive military threat on an infrastructure system that requires extraordinarily expensive measures to defend. Airports, ports and energy installations may need additional surveillance, counter-drone systems and local air defence even if no attack ultimately occurs.

The economic consequences could therefore arrive before any explosion.

A suspected drone threat near a major airport could interrupt flights. A security incident at a port could slow cargo movements. Energy facilities could require additional protection. Tourism-dependent regions could face disruption if repeated incidents create perceptions of insecurity.

For governments, the cost of preventing one low-probability attack can become significant long before its probability is established.

Southern Europe becomes part of the pressure campaign

The geographic choice also matters.

Spain, France and Italy are not on NATO's eastern frontier, but their infrastructure is deeply connected to the European economy. Their ports, airports, energy installations and tourism sectors operate at a scale that makes even temporary disruption economically consequential.

The political calendar adds another dimension. All three countries face important political pressures ahead of the 2027 electoral cycle. In France, President Emmanuel Macron convened the National Defence Council and subsequently brought political leaders and presidential candidates together for consultations over growing hybrid threats.

The immediate question for governments is not simply whether Russia could physically damage a particular installation. It is whether repeated incidents could alter political behaviour.

A hybrid campaign does not need to produce conventional battlefield victories. It can instead create uncertainty over the cost of supporting Ukraine, increase public pressure to reduce military exposure and deepen existing divisions over European security policy.

That makes ambiguity useful.

A drone launched from a commercial vessel creates a problem of attribution as well as detection. If responsibility cannot be established immediately, governments face a difficult choice between responding to an attack whose origins remain contested and accepting further risk.

For Moscow, the space between those choices is strategically valuable.

From sabotage to maritime force projection

The reported Mediterranean scenario also marks a broader evolution in the nature of the Russian hybrid threat described in the briefing.

Earlier European cases involved cyber operations, intelligence activity, sabotage, and drones entering national airspace. More recent incidents have increasingly connected those methods to physical infrastructure and logistics.

The German cases involving drones and explosive materials near Wunstorf Bundeswehr Air Base and Leipzig/Halle Airport, for example, were linked by prosecutors to Russian intelligence activity targeting Ukrainian transport logistics. In the Baltic, military and surveillance incidents have added another layer of pressure.

The Mediterranean proposal would connect these strands to maritime mobility.

That is important because commercial shipping provides something conventional military platforms cannot easily offer: enormous numbers of legitimate movements among which a hostile capability can potentially disappear.

The result is a form of power projection that remains deliberately below the threshold of open warfare.

Russia would not need to establish permanent military bases in the Mediterranean to create a persistent security problem. It would only need to demonstrate that ordinary maritime infrastructure could be used unpredictably.

The Article 5 problem

This creates one of the most difficult questions for NATO: where does hybrid warfare end and an act of war begin?

A single drone incident would not automatically resolve that question. Attribution, intent, scale and consequences would all matter. The alliance's collective-defence mechanism is designed around an armed attack, but hybrid operations deliberately exploit uncertainty about whether an incident constitutes such an attack.

That ambiguity can become a weapon in itself.

If a drone strikes a military installation, the political calculation is different from an unexplained explosion at a commercial port. If an attack causes limited physical damage but major economic disruption, governments face another set of choices. And if the platform was launched from a civilian vessel whose ownership, crew and cargo are difficult to connect directly to the Russian state, attribution becomes even harder.

The objective, therefore, need not be to cross NATO's red line.

It may be to operate permanently beside it.

Europe’s rear is no longer necessarily a rear

The intelligence shared with European governments has not been publicly ratified by the CIA or by Spain, France and Italy as of September 24. Much of the reported operational scenario remains an intelligence assessment rather than a confirmed attack plan.

That distinction matters. So does the fact that some of the most dramatic material circulating the threat, including Russian Telegram commentary describing hypothetical targets in southern France, remains speculative.

But the underlying security problem does not depend on every element of the scenario being confirmed.

The vulnerability is structural. European maritime trade depends on open waters, predictable shipping procedures and enormous volumes of legitimate commercial movement. European air defence, meanwhile, must protect infrastructure spread across territory that was traditionally considered strategically distant from the main battlefield.

A cheap drone does not have to defeat that system militarily.

It can test whether the system can afford to respond everywhere at once.

That is the pressure now moving into the Mediterranean: not necessarily a new front in the conventional sense, but a new demand on European states to defend the economic and civilian systems that make the continent function. The more assets governments move towards ports, airports and energy facilities, the harder it becomes to maintain the same level of protection elsewhere.

The strategic question is no longer simply whether NATO can intercept a small drone.